flubot | 1a2564deee63efcde8a9c68c615762e39bfda3b4ed7b56913a14f8f8c959c78a

General

Target

1a2564deee63efcde8a9c68c615762e39bfda3b4ed7b56913a14f8f8c959c78a.apk
Size

3.4MB
MD5

d798d1e85f367e0c3bacebb8ed7b42c8
SHA1

c3e9a0cd393480fe05cb66dfe0929b479e0d2fb3
SHA256

1a2564deee63efcde8a9c68c615762e39bfda3b4ed7b56913a14f8f8c959c78a
SHA512

919e48f8114991a93708c1967d2429018804b052b488a3d6363d2ca69035d937f51b8ae84efc29197eefd11641660e39f7bbe9a219a223cc842b6cdf5e072304
SSDEEP

98304:z/8S9xHTQa7uY+EaTLhRvObeeLz+YQpwgY7dNjWYEz6/L:YS9xzt+x4TzypwP73U6/L

Score

10^/10

flubot banker collection credential_access discovery evasion impact infostealer persistence trojan

Malware Config

Signatures

FluBot
FluBot is an android banking trojan that uses overlays.
banker trojan infostealer flubot

FluBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-5.dat	family_flubot
behavioral1/memory/4249-3.dex	family_flubot

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/glk33e.dkdyu.iiyee/app_apkprotector_dex/classes-v1.bin	4249	glk33e.dkdyu.iiyee
/data/user/0/glk33e.dkdyu.iiyee/app_apkprotector_dex/classes-v1.bin	4275	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/glk33e.dkdyu.iiyee/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/glk33e.dkdyu.iiyee/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/glk33e.dkdyu.iiyee/app_apkprotector_dex/classes-v1.bin	4249	glk33e.dkdyu.iiyee
/data/user/0/glk33e.dkdyu.iiyee/app_ded/0E5ddwpPz4OZXIWMFVADnVwfCwJMlCbG.dex	4249	glk33e.dkdyu.iiyee
/data/user/0/glk33e.dkdyu.iiyee/app_ded/0E5ddwpPz4OZXIWMFVADnVwfCwJMlCbG.dex	4300	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/glk33e.dkdyu.iiyee/app_ded/0E5ddwpPz4OZXIWMFVADnVwfCwJMlCbG.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/glk33e.dkdyu.iiyee/app_ded/oat/x86/0E5ddwpPz4OZXIWMFVADnVwfCwJMlCbG.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/glk33e.dkdyu.iiyee/app_ded/0E5ddwpPz4OZXIWMFVADnVwfCwJMlCbG.dex	4249	glk33e.dkdyu.iiyee

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	glk33e.dkdyu.iiyee
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	glk33e.dkdyu.iiyee
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	glk33e.dkdyu.iiyee

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	glk33e.dkdyu.iiyee

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	glk33e.dkdyu.iiyee
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	glk33e.dkdyu.iiyee

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	glk33e.dkdyu.iiyee

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	glk33e.dkdyu.iiyee

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	glk33e.dkdyu.iiyee

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	glk33e.dkdyu.iiyee

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	glk33e.dkdyu.iiyee

glk33e.dkdyu.iiyee
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4249
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/glk33e.dkdyu.iiyee/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/glk33e.dkdyu.iiyee/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4275
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/glk33e.dkdyu.iiyee/app_ded/0E5ddwpPz4OZXIWMFVADnVwfCwJMlCbG.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/glk33e.dkdyu.iiyee/app_ded/oat/x86/0E5ddwpPz4OZXIWMFVADnVwfCwJMlCbG.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4300

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

User Evasion

1

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Protected User Data

1

T1636

SMS Messages

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

SMS Control

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/glk33e.dkdyu.iiyee/app_apkprotector_dex/classes-v1.bin

Filesize
120KB

MD5
c384c5cdaf8f3edfa29389f2de2effea

SHA1
5e5dad9692cf5794e3ff7b99a64e6555399bc56f

SHA256
0f145035801825a43c9aba19597cb6ee6737088c4f058a66d6b87f144a046062

SHA512
7ea82780f2a46f8c297a35c16bb2e51136d4297fd2c4e6409b595b97d9490dfd65d00352a07ca6cd86b4f2fbfceeb5ab8d15f515395104be61629af56046c780

Download Submit
/data/data/glk33e.dkdyu.iiyee/app_ded/0E5ddwpPz4OZXIWMFVADnVwfCwJMlCbG.dex

Filesize
2.2MB

MD5
8eb4bd70dc872f1c8bc2cba29cf5f3e0

SHA1
37e4f72a16aebfbeeff9d9cb64044f4668d4e59c

SHA256
4313d3eb67340e6b0301431f904373d681922aa9f0fe7cafa02952d7e13bfe09

SHA512
46ff565790b6c19c0c8abdca0b431eaf2c0206fc8658d7c069c87d595ac0b61ed631d8afb6b8c76f94877f951e604e708a8fce39acf3aba8807bbed008a63eb1

Download Submit
/data/user/0/glk33e.dkdyu.iiyee/app_apkprotector_dex/classes-v1.bin

Filesize
120KB

MD5
5e0ca1f47d3a8db8a8124c2cc1764665

SHA1
4b12e946982d6734639b598e1c07de978742d57d

SHA256
82bda6c0b3a3a18143df2b9719f11a455bee95300adb6eec16ec3c0cb210edf9

SHA512
447bcbf794f066e711e7d3f517c04d15ec705e4e1e271d82428abb467c888fb3ee5dc235192087f2df7f57baea974a2feb862671f4eb81605468962ace39712b

Download Submit
/data/user/0/glk33e.dkdyu.iiyee/app_ded/0E5ddwpPz4OZXIWMFVADnVwfCwJMlCbG.dex

Filesize
2.2MB

MD5
e537222c89c0b36564ba240b33daf5bb

SHA1
df7b6863fc7e5c27d96602d2fafb278371ac8712

SHA256
efb8eb19ed42462b5575b5b71512783d4c7a51ad3aa286add54be3c642de81a0

SHA512
ff165c1cd1303fef0050ce20eb52793efccbf31bb728032267dbbcf6bafcfb34f71e1936d2d04f91b56f835f223c5dbc0074b5d6d7a88fc04fec4280c989591a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads